S3 API Supported Actions
DanubeData Object Storage provides S3-compatible storage powered by Ceph RGW. The following tables list supported S3 API actions and known limitations.
Bucket Operations
| Action | Status | Limitations |
|---|---|---|
CreateBucket | Not supported | Buckets must be created via the DanubeData dashboard or API |
DeleteBucket | Not supported | Buckets must be deleted via the DanubeData dashboard or API |
HeadBucket | Supported | |
ListBuckets | Supported | |
GetBucketLocation | Supported | |
GetBucketVersioning / PutBucketVersioning | Supported | |
GetBucketPolicy / PutBucketPolicy | Supported | |
GetBucketCors / PutBucketCors / DeleteBucketCors | Supported | |
GetBucketLifecycleConfiguration / PutBucketLifecycleConfiguration | Supported | |
GetBucketTagging / PutBucketTagging / DeleteBucketTagging | Supported | |
GetBucketEncryption / PutBucketEncryption / DeleteBucketEncryption | Supported | SSE-S3 (AES-256) and SSE-KMS |
GetBucketAcl / PutBucketAcl | Supported | |
GetBucketRequestPayment | Not supported | |
GetBucketNotification | Not supported | |
GetBucketAccelerateConfiguration | Not supported | |
GetBucketWebsite | Not supported | |
GetBucketAnalyticsConfiguration | Not supported | |
GetBucketIntelligentTieringConfiguration | Not supported | |
GetBucketInventoryConfiguration | Not supported | |
GetBucketLogging | Not supported | |
GetBucketMetricsConfiguration | Not supported | |
GetBucketOwnershipControls | Not supported | |
GetBucketReplication | Not supported |
Object Operations
| Action | Status | Limitations |
|---|---|---|
PutObject | Supported | Max 5 TB per object |
GetObject | Supported | |
HeadObject | Supported | |
DeleteObject | Supported | |
DeleteObjects (multi-delete) | Supported | |
CopyObject | Supported | Works on server-side encrypted objects |
ListObjects / ListObjectsV2 | Supported | |
GetObjectTagging / PutObjectTagging / DeleteObjectTagging | Supported | |
GetObjectAcl / PutObjectAcl | Supported | |
RestoreObject | Not supported | |
SelectObjectContent | Not supported | |
GetObjectTorrent | Not supported | |
GetObjectAttributes | Not supported |
Object Lock Operations
Object Lock provides write-once-read-many (WORM) retention. See Object Storage security for how modes and retention work.
| Action | Status | Limitations |
|---|---|---|
GetObjectLockConfiguration | Supported | Object Lock must be enabled when the bucket is created; it cannot be added to an existing bucket |
PutObjectLockConfiguration | Supported | Requires a team-wide access key; bucket-scoped keys cannot change the bucket's default retention. Set it from the bucket's Settings tab instead |
GetObjectRetention / PutObjectRetention | Supported | GOVERNANCE and COMPLIANCE modes. A scoped key can add or extend a retention, never shorten one |
GetObjectLegalHold / PutObjectLegalHold | Supported | |
BypassGovernanceRetention | Team-wide keys only | Bucket-scoped keys can never delete a locked version before its retention expires |
Multipart Upload Operations
| Action | Status | Limitations |
|---|---|---|
CreateMultipartUpload | Supported | |
UploadPart | Supported | |
UploadPartCopy | Partial | See encryption limitation below |
CompleteMultipartUpload | Supported | |
AbortMultipartUpload | Supported | |
ListMultipartUploads | Supported | |
ListParts | Supported |
Server-Side Encryption
| Action | Status | Limitations |
|---|---|---|
| SSE-S3 (AES-256) | Supported | Managed encryption keys via Vault |
| SSE-KMS | Supported | Customer-managed keys via Vault Transit |
| SSE-C (customer-provided keys) | Supported | Client provides key with each request |
Presigned URLs
| Action | Status | Limitations |
|---|---|---|
| Presigned GET (download) | Supported | Configurable expiration |
| Presigned PUT (upload) | Supported | Configurable expiration |
Known Limitations
UploadPartCopy and Server-Side Encryption
UploadPartCopy is not supported for server-side encrypted objects. This applies to all server-side encryption methods (SSE-S3, SSE-KMS, and SSE-C). Attempting a multipart server-side copy of an encrypted object returns a 501 Not Implemented error.
CopyObject is no longer affected. Server-side copies of encrypted objects work normally as of the 2026-08-07 storage platform update, which shipped the upstream fix (Ceph PR #63794, released in Ceph v20.2.3). Only the multipart copy path remains outstanding.
The remaining limitation is tracked upstream in Ceph Tracker #23264.
Impact: S3 clients switch from CopyObject to the multipart copy path for large objects, so move, rename, and metadata-update operations on encrypted objects can still fail above a certain size. The threshold is client-specific — the AWS CLI defaults to 8 MB (multipart_threshold) — and above 5 GB multipart copy is the only option, since CopyObject cannot be used for objects larger than that.
Workarounds:
- Raise the client's multipart threshold — Keeping objects under the threshold routes them through
CopyObject, which now works on encrypted objects. For the AWS CLI:aws configure set default.s3.multipart_threshold 5GB. - Client-side encryption — Encrypt data before uploading. The storage backend sees unencrypted blobs, so all copy operations work normally. Tools like rclone (
--crypt), Cryptomator, restic, and Duplicati support this. - Download and re-upload — Instead of a server-side copy, download the object and upload it to the new location.
We are tracking the remaining upstream fix and will update this page when it is resolved.
Questions? Contact support at support@danubedata.ro